CN111818525B - Secret key updating method and system facing space information network - Google Patents

Abstract

The invention provides a secret key updating method and a secret key updating system facing to a space information network, which are applied to a communication satellite and comprise the following steps: generating a target session key based on the seed key before updating; acquiring a target encryption parameter; the target encryption parameter is obtained after the ground control center corresponding to the communication satellite encrypts the seed key synchronization parameter by using a target session key; decrypting the target encryption parameter by using the target session key to obtain a seed key synchronization parameter; determining an updated seed key in a preset seed key matrix based on the seed key synchronization parameter; the preset seed key matrix is a matrix formed by taking the preset seed keys as matrix elements, wherein one matrix element corresponds to one preset seed key. The invention solves the technical problem of complex key distribution mode in the prior art.

Description

Key update method and system for spatial information network

technical field

The invention relates to the technical field of network security, in particular to a key update method and system oriented to a spatial information network.

Background technique

Satellite communication is a communication method that can provide users with ubiquitous access. Whether you are in the city, the sea or the desert, you can communicate as long as you are within the coverage of the radio waves emitted by the satellite, regardless of geographic location. Whether in civilian or military use, satellite communications will have an irreplaceable position in the future. With the increasing role of satellite communication in the communication field, new requirements have been put forward for the security of satellite communication.

At present, the security of satellite communication generally adopts the data encryption system of the ground communication network, that is, the data is encrypted by the symmetric encryption system. The security of the symmetric encryption system mainly depends on the security of the key. In key distribution, asymmetric cryptography is commonly used to encrypt symmetric keys. However, the asymmetric encryption system involves large number operations in the encryption and decryption process, the algorithm complexity is high, and the encryption and decryption speed is very slow. high-latency space communication network.

SUMMARY OF THE INVENTION

In view of this, the purpose of the present invention is to provide a key update method and system oriented to a spatial information network, so as to alleviate the technical problem of complex key distribution in the prior art.

In a first aspect, an embodiment of the present invention provides a method for updating a key for a space information network, which is applied to a communication satellite, including: generating a target session key based on a seed key before updating; acquiring target encryption parameters; The target encryption parameter is the encryption parameter obtained after the ground control center corresponding to the communication satellite uses the target session key to encrypt the seed key synchronization parameter; the target encryption parameter is decrypted using the target session key , obtain the seed key synchronization parameter; based on the seed key synchronization parameter, determine the updated seed key in the preset seed key matrix; the preset seed key matrix is based on the preset seed key is a matrix composed of matrix elements, wherein one matrix element corresponds to a preset seed key.

Further, generating the target session key based on the seed key before the update includes: initializing the Zu Chongzhi algorithm set based on the seed key before the update, and obtaining the Zu Chongzhi algorithm set after the initialization; using the Zu Chongzhi algorithm after the initialization set to generate the target session key.

Further, determining an updated seed key in a preset seed key matrix based on the seed key synchronization parameter, including: generating a seed key pointer based on the seed key synchronization parameter; a key pointer, and a target matrix element is determined in the preset seed key matrix; the preset seed key corresponding to the target matrix element is determined as the updated seed key.

Further, the method further includes: generating an initial session key, including: acquiring an initial seed key synchronization parameter; generating an initial seed key pointer based on the initial seed key synchronization parameter; based on the initial seed key pointer , determine the initial matrix element in the preset seed key matrix; determine the preset seed key corresponding to the initial matrix element as the initial seed key; based on the initial seed key and Zu Chongzhi's algorithm set, generate Initial session key.

Further, the method further includes: updating the preset seed key matrix.

Further, updating the preset seed key matrix includes: acquiring a target encryption matrix element; the target encryption matrix element is the ground control center, and using the matrix element corresponding to the matrix element to be updated in the preset seed key matrix. The preset seed key and the target session key, the encryption matrix element obtained after encrypting the new preset seed key; based on the preset seed key corresponding to the matrix element to be updated and the target session key, decrypt the target encryption matrix element to obtain the new preset seed key; use the new preset seed key as the matrix element to be updated, and update the preset seed key matrix.

In a second aspect, an embodiment of the present invention further provides a key update system oriented to a space information network, applied to a communication satellite, including: a generation module, an acquisition module, a decryption module, and an update module, wherein the generation module uses generating a target session key based on the seed key before the update; the obtaining module is used to obtain a target encryption parameter; the target encryption parameter is that the ground control center corresponding to the communication satellite uses the target session key, encryption parameters obtained after encrypting the seed key synchronization parameters; the decryption module is configured to decrypt the target encryption parameters by using the target session key to obtain the seed key synchronization parameters; the update module , for determining the updated seed key in a preset seed key matrix based on the seed key synchronization parameter; the preset seed key matrix is a matrix formed by taking the preset seed key as matrix elements , where one matrix element corresponds to a preset seed key.

Further, the system further includes: a key matrix updating module for updating the preset seed key matrix.

In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, where the processor executes the computer program When implementing the steps of the method described in the first aspect above.

In a fourth aspect, an embodiment of the present invention further provides a computer-readable medium having non-volatile program code executable by a processor, where the program code enables the processor to execute the method in the first aspect.

The invention provides a method and system for updating a key for a spatial information network. First, based on a seed key before updating, a target session key is generated; a target encryption parameter is obtained; and then the target encryption parameter is decrypted by using the target session key. , obtain the seed key synchronization parameter; finally, based on the seed key synchronization parameter, determine the updated seed key in the preset seed key matrix, the embodiment of the present invention distributes the seed key synchronization parameter by encrypting it, and then uses The seed key synchronization parameter is combined with the preset seed key matrix to realize the key distribution process in the satellite communication process, which not only ensures the security of key distribution, but also alleviates the key distribution existing in the prior art. way to complex technical issues.

Description of drawings

In order to illustrate the specific embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the specific embodiments or the prior art. Obviously, the accompanying drawings in the following description The drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without creative efforts.

1 is a flowchart of a method for updating a key for a spatial information network according to an embodiment of the present invention;

2 is a flowchart of a method for surviving an initial session key provided by an embodiment of the present invention;

3 is a schematic diagram of a satellite communication network according to an embodiment of the present invention;

4 is a flowchart of a method for generating a session key provided by an embodiment of the present invention;

5 is a flowchart of a method for updating a seed key provided by an embodiment of the present invention;

6 is a flowchart of a method for updating a seed key matrix provided by an embodiment of the present invention;

7 is a schematic diagram of a spatial information network-oriented key update system provided by an embodiment of the present invention;

FIG. 8 is a schematic diagram of another key update system oriented to a spatial information network provided by an embodiment of the present invention.

Detailed ways

The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Example 1:

FIG. 1 is a flowchart of a method for updating a key for a space information network according to an embodiment of the present invention, and the method is applied to a communication satellite in a satellite communication network. Wherein, the satellite communication network also includes a ground control center corresponding to the communication satellite. As shown in Figure 1, the method specifically includes the following steps:

In step S102, a target session key is generated based on the seed key before the update.

In the embodiment of the present invention, the seed key is used for the initialization of Zu Chongzhi's algorithm set (ZUC algorithm), and the seed key before updating is respectively stored on the communication satellite and the ground control center of the satellite communication network. Both the communication satellite and the ground control center can generate the target session key by updating the previous seed key. The target session key is used to encrypt the communication process of the satellite communication network.

Specifically, based on the seed key before the update, initialize the Zu Chongzhi algorithm set to obtain the Zu Chongzhi algorithm set after initialization; use the Zu Chongzhi algorithm set after initialization to generate the target session key.

Step S104, acquiring target encryption parameters; the target encryption parameters are encryption parameters obtained after the ground control center corresponding to the communication satellite uses the target session key to encrypt the seed key synchronization parameter. The seed key synchronization parameter is a parameter for updating the seed key.

Step S106: Decrypt the target encryption parameter by using the target session key to obtain the seed key synchronization parameter.

Step S108, based on the seed key synchronization parameter, determine the updated seed key in the preset seed key matrix; the preset seed key matrix is a matrix formed by using the preset seed key as matrix elements, wherein one The matrix element corresponds to a preset seed key.

Optionally, after updating the seed key by using the seed key synchronization parameter, the communication satellite may discard or revoke the seed key synchronization parameter.

A key update method oriented to a space information network provided by an embodiment of the present invention, by encrypting the seed key synchronization parameters and then distributing them, and then using the seed key synchronization parameters in combination with a preset seed key matrix, to realize the satellite key synchronization parameters. The key distribution process in the communication process not only ensures the security of key distribution, but also alleviates the technical problem of complex key distribution methods existing in the prior art.

In this embodiment of the present invention, before updating the seed key, the method further includes: generating an initial session key. FIG. 2 is a flowchart of a method for surviving an initial session key provided according to an embodiment of the present invention. It should be noted that the method can be applied to a communication satellite in a satellite communication network, and can also be applied to a satellite communication network in a satellite communication network. ground control center. Specifically, as shown in Figure 2, the method includes the following steps:

Step S201, obtaining the initial seed key synchronization parameter; the initial seed key synchronization parameter is the parameter preloaded into the ground control center and the communication satellite;

Step S202, generating an initial seed key pointer based on the initial seed key synchronization parameter;

Step S203, based on the initial seed key pointer, determine the initial matrix element in the preset seed key matrix;

Step S204, determining the preset seed key corresponding to the initial matrix element as the initial seed key;

Step S205, generate an initial session key based on the initial seed key and Zu Chongzhi's algorithm set; specifically, use the initial seed key as an initialization parameter of Zu Chongzhi's algorithm set to generate an initial session key.

Optionally, step S108 further includes the following steps:

Step S1081, generating a seed key pointer based on the seed key synchronization parameter;

Step S1082, based on the seed key pointer, determine the target matrix element in the preset seed key matrix;

Step S1083: Determine the preset seed key corresponding to the target matrix element as the updated seed key.

In the embodiment of the present invention, after the target session key is generated, each time the ground control center updates the seed key, the target session key is used to encrypt the new seed key synchronization parameter, and then the encrypted seed key is synchronized The parameters are sent to the communication satellite; after the communication satellite receives the ciphertext, it can directly decrypt the target session key to obtain the synchronization parameters of the new seed key.

Optionally, the method provided by the embodiment of the present invention further includes: updating a preset seed key matrix. Specifically, it includes the following steps:

Step S301, obtaining a target encryption matrix element; the target encryption matrix element is the ground control center, and the new preset seed key and the target session key corresponding to the matrix element to be updated in the preset seed key matrix are used to update the new preset seed key. The encrypted matrix element obtained after the key is encrypted;

Step S302, based on the preset seed key corresponding to the matrix element to be updated and the target session key, decrypt the target encryption matrix element to obtain a new preset seed key;

Step S303, update the preset seed key matrix by using the new preset seed key as the matrix element to be updated.

When updating the seed key matrix in the embodiment of the present invention, a new seed key matrix is first generated by the ground control center. Encrypt the corresponding new preset seed key in the new seed key matrix with the corresponding old seed key and target session key in the old seed key matrix, obtain the ciphertext and send it to the communication satellite; the communication satellite decrypts its ciphertext by decrypting the new preset seed key. The elements in the seed key matrix can be updated, and the seed key matrix is updated when all elements are updated.

The embodiments of the present invention provide a key update method and system for a space information network, which can be based on the use of a symmetric encryption system in a satellite communication network, and the distribution network of the symmetric key does not depend on the traditional asymmetric encryption system. , and double encryption is performed by the current seed key matrix parameters and the session key when the key is updated, which greatly increases the security of session key update and distribution, and at the same time alleviates the complex key distribution method existing in the prior art. technical problem.

Embodiment 2:

In the embodiment of the present invention, a method for updating a key for a space information network in the above-mentioned first embodiment is specifically described and explained in conjunction with a specific satellite communication network example. The specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

FIG. 3 is a schematic diagram of a satellite communication network according to an embodiment of the present invention. As shown in FIG. 3 , the satellite communication network includes a control center (NOCC), a gateway (GW) and a satellite (Satellite Network), and the key distribution and update process is applied between the control center and the satellite.

A method for updating a key for a spatial information network provided by an embodiment of the present invention includes: generating a session key, updating a seed key, and updating a seed key matrix. The symmetric encryption algorithm takes the ZUC encryption algorithm as an example.

FIG. 4 is a flowchart of a method for generating a session key provided according to an embodiment of the present invention, as shown in FIG. 4 , which specifically includes the following steps:

Step S401, generate a seed key pointer {x _i , y _i }.

Both the control center and the satellite will preload the same seed key matrix and initial seed key synchronization parameters. The initial seed key synchronization parameter IKEY _ini is 256 bits in length. First, it is divided into the first 128-bit IKSP ₁ and the last 128-bit IKSP ₂ ;

Use IKSP ₁ to generate the abscissa x _i of the pointer, and divide IKSP ₁ into 32 blocks with a length of 4 bits: IKSP ₁ [0], IKSP ₁ [1], ..., IKSP ₁ [31]. Then XOR all the 32 blocks to obtain a 4-bit long result value, and convert it into decimal system to obtain the abscissa x _i .

The ordinate _yi of the pointer can be generated in the same way. So far, the seed key pointer {x _i , y _i } indicating the encryption used for the current session is obtained.

Step S402, selecting a seed key.

为种子密钥。According to the generated seed key pointer {x _i ,y _i }, select the corresponding seed key IK _i in the 16×16 seed key matrix Matrix[x _i ,y _i ] and output the result, which can be used as ZUC The seed key for serial cipher encryption. in,

is the seed key.

In step S403, a session key K _s is generated.

The length of the seed key IK is 256 bits, which is used as the initialization parameter of the ZUC sequence encryption algorithm, and the session key K _s can be obtained by inputting it.

FIG. 5 is a flowchart of a method for updating a seed key according to an embodiment of the present invention, as shown in FIG. 5 , which specifically includes:

The control center selects a new seed key IK _i , and converts the position of IK _i in the seed key matrix from the decimal seed key pointer {x _i , y _i } to the binary seed key synchronization parameter IKEY _i ; Use the session key Ks to directly encrypt the seed key synchronization parameter _{IKEY i} to obtain the ciphertext C; send the ciphertext C to the satellite through the gateway;

The satellite decrypts the ciphertext C with the session key K _s , obtains the seed key synchronization parameter IKEY _i , and uses IKEY _i to generate the seed key pointer {x _i , y _i }, which can be used in the seed key matrix Matrix[x _i , y _i ] select the new seed key IK _i .

The seed key synchronization parameter IKEY _i encryption process is described as follows:

FIG. 6 is a flowchart of a method for updating a seed key matrix provided according to an embodiment of the present invention, as shown in FIG. 6 , which specifically includes:

The control center generates a new seed key matrix Matrix[IK _i ], and encrypts the seed key IK _i in turn and sends it to the satellite. The satellite decrypts and obtains a new seed key IK _i and sequentially updates the seed key IK i in its seed key matrix. element; repeat the above process until the update of the satellite seed key matrix is completed.

加密新种子密钥矩阵中对应位置的种子密钥IK_i；再使用会话密钥K_s进行第二次加密即可得到种子密钥IK_i的密文C_i；种子密钥IK_i加密过程描述如下：Specifically, the control center uses the seed key in the old seed key matrix

Encrypt the seed key IK _i of the corresponding position in the new seed key matrix; Use the session key K _s to carry out the second encryption to obtain the ciphertext C _i of the seed key IK _i ; The seed key IK _i encryption process description as follows:

即可解密得到新种子密钥IK_i；卫星将其IK_i作为新种子密钥替换种子密钥矩阵中对应的旧种子密钥

Send the ciphertext C _i to the satellite, and the satellite uses the session key K _s and the corresponding old seed key in the seed key matrix

The new seed key IK _i can be obtained by decryption; the satellite uses its IK _i as the new seed key to replace the corresponding old seed key in the seed key matrix

The encryption algorithms used in the above-described embodiments of the present invention are published encryption standards, which are not within the protection scope of the present invention.

Embodiment three:

FIG. 7 is a schematic diagram of a key update system for a space information network provided according to an embodiment of the present invention, and the system is applied to a communication satellite. As shown in FIG. 7 , the system includes: a generation module 10 , an acquisition module 20 , a decryption module 30 and an update module 40 .

Specifically, the generating module 10 is configured to generate the target session key based on the seed key before updating.

The obtaining module 20 is used for obtaining the target encryption parameter; the target encryption parameter is the encryption parameter obtained after the ground control center corresponding to the communication satellite uses the target session key to encrypt the seed key synchronization parameter.

The decryption module 30 is used for decrypting the target encryption parameter by using the target session key to obtain the seed key synchronization parameter.

The updating module 40 is configured to determine the updated seed key in the preset seed key matrix based on the seed key synchronization parameter; the preset seed key matrix is a matrix formed by using the preset seed key as matrix elements, Among them, one matrix element corresponds to a preset seed key.

A key update system oriented to a space information network provided by an embodiment of the present invention encrypts the seed key synchronization parameters and distributes them, and then uses the seed key synchronization parameters in combination with a preset seed key matrix to realize the satellite key synchronization parameters. The key distribution process in the communication process not only ensures the security of key distribution, but also alleviates the technical problem of complex key distribution methods existing in the prior art.

Optionally, FIG. 8 is a schematic diagram of another key update system oriented to a spatial information network provided according to an embodiment of the present invention. As shown in FIG. 8 , the system further includes: a key matrix update module 50 for updating Preset seed key matrix.

Specifically, the key matrix update module 50 is also used for:

Obtain the target encryption matrix element; the target encryption matrix element is the ground control center, and use the preset seed key and the target session key corresponding to the matrix element to be updated in the preset seed key matrix to perform a new preset seed key. The encryption matrix element obtained after encryption; based on the preset seed key corresponding to the matrix element to be updated and the target session key, decrypt the target encryption matrix element to obtain a new preset seed key; encrypt the new preset seed The key is used as the matrix element to be updated, and the preset seed key matrix is updated.

An embodiment of the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor, where the processor implements the steps of the method in the first embodiment when the processor executes the computer program.

An embodiment of the present invention further provides a computer-readable medium having a non-volatile program code executable by a processor, and the program code enables the processor to execute the method in the first embodiment above.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions described in the foregoing embodiments can still be modified, or some or all of the technical features thereof can be equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the embodiments of the present invention. scope.

Claims (9)

1. a key update method for space information network, applied to communication satellite, is characterized in that, comprises: Generate the target session key based on the seed key before the update; Obtaining a target encryption parameter; the target encryption parameter is the encryption parameter obtained after the ground control center corresponding to the communication satellite uses the target session key to encrypt the seed key synchronization parameter; Use the target session key to decrypt the target encryption parameter to obtain the seed key synchronization parameter; Based on the seed key synchronization parameter, the updated seed key is determined in a preset seed key matrix; the preset seed key matrix is a matrix formed by using the preset seed key as a matrix element, wherein, A matrix element corresponds to a preset seed key; Based on the seed key synchronization parameters, the updated seed key is determined in the preset seed key matrix, including: generating a seed key pointer based on the seed key synchronization parameter; Based on the seed key pointer, determining a target matrix element in the preset seed key matrix; The preset seed key corresponding to the target matrix element is determined as the updated seed key. 2. The method according to claim 1, wherein the target session key is generated based on the seed key before the update, comprising: Based on the seed key before the update, initialize the Zu Chongzhi algorithm set to obtain the Zu Chongzhi algorithm set after initialization; Using the Zu Chongzhi algorithm set after the initialization, the target session key is generated. 3. The method according to claim 1, wherein the method further comprises: generating an initial session key, comprising: Get the initial seed key synchronization parameters; generating an initial seed key pointer based on the initial seed key synchronization parameter; based on the initial seed key pointer, determining an initial matrix element in the preset seed key matrix; Determining the preset seed key corresponding to the initial matrix element as the initial seed key; Based on the initial seed key and Zu Chongzhi's algorithm set, an initial session key is generated. 4. The method according to claim 1, wherein the method further comprises: updating the preset seed key matrix. 5. The method according to claim 4, wherein updating the preset seed key matrix comprises: Obtain a target encryption matrix element; the target encryption matrix element is the ground control center, using the preset seed key corresponding to the matrix element to be updated in the preset seed key matrix and the target session key, for new The encryption matrix element obtained after the preset seed key is encrypted; Decrypt the target encryption matrix element based on the preset seed key corresponding to the matrix element to be updated and the target session key to obtain the new preset seed key; Using the new preset seed key as the matrix element to be updated, the preset seed key matrix is updated. 6. A key update system oriented to a space information network, applied to a communication satellite, is characterized in that, comprising: a generation module, an acquisition module, a decryption module and an update module, wherein, The generating module is used to generate the target session key based on the seed key before the update; The obtaining module is used to obtain the target encryption parameter; the target encryption parameter is the encryption parameter obtained after the ground control center corresponding to the communication satellite uses the target session key to encrypt the seed key synchronization parameter; The decryption module is configured to decrypt the target encryption parameter by using the target session key to obtain the seed key synchronization parameter; The updating module is configured to determine the updated seed key in a preset seed key matrix based on the seed key synchronization parameter; the preset seed key matrix is a matrix element with the preset seed key The formed matrix, wherein one matrix element corresponds to a preset seed key. 7 . The system according to claim 6 , wherein the system further comprises: a key matrix updating module, configured to update the preset seed key matrix. 8 . 8. An electronic device comprising a memory, a processor and a computer program stored on the memory and running on the processor, wherein the processor implements the above claims when executing the computer program The steps of any one of 1 to 5 of the method. 9. A computer-readable medium having non-volatile program code executable by a processor, wherein the program code causes the processor to perform the method of any one of claims 1-5.

Images